Medium
CVE-2026-16739
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-27536
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-19088
ShopEngine <= 4.9.2 - Cross-Site Request Forgery
High
CVE-2026-27537
Smart Popup by Supsystic <= 1.11.2 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-27544
QA Assistants – Driven by data <= 5.2.0.0 - Unauthenticated Remote Code Execution
High
CVE-2026-61969
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.6.0 - Unauthenticated SQL Injection
Medium
CVE-2026-14549
Ray Enterprise Translation <= 1.7.3 - Missing Authorization
High
CVE-2026-66657
Biagiotti Core <= 2.1.1 - Unauthenticated Local File Inclusion
Critical
CVE-2026-61962
WP BASE Booking of Appointments, Services and Events <= 6.3.0 - Unauthenticated Remote Code Execution
Critical
CVE-2026-14182
Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Privilege Escalation
Critical
CVE-2026-61967
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Unauthenticated Privilege Escalation
Critical
CVE-2026-27543
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.20.0 - Unauthenticated Privilege Escalation
High
CVE-2026-27539
Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-27535
Solace Extra <= 1.6.0 - Missing Authorization
Medium
CVE-2026-66660
Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 - Missing Authorization
Medium
CVE-2026-27538
WP Directory Kit <= 1.5.4 - Unauthenticated SQL Injection
Medium
CVE-2026-66655
MultiParcels Shipping For WooCommerce <= 1.30.36 - Reflected Cross-Site Scripting
High
CVE-2026-66659
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.9 - Unauthenticated SQL Injection
Medium
CVE-2026-66654
Vehica Core <= 1.0.104 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2026-27999
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.23.1 - Missing Authorization
Medium
CVE-2026-14290
Embed Google Photos Album Easily <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-11578
Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion
Medium
CVE-2026-68871
The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deploy
Medium
CVE-2026-68872
The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.